Mirage2FA is a phishing-as-a-service toolkit that steals Microsoft 365 credentials and authenticated sessions using Adversary-in-the-Middle attacks to bypass MFA. ANY.RUN found the campaign is heavily concentrated in the United States and targets industries such as Technologies, Manufacturing, and Education, with thousands of potential compromise events between 2024 and 2026. #Mirage2FA #Microsoft365 #ANYRUN #LinXCoders
Keypoints
- Mirage2FA is a commercial phishing-as-a-service toolkit designed to hijack Microsoft 365 sessions and bypass conventional MFA.
- The attack uses an Adversary-in-the-Middle flow to capture credentials, 2FA codes, and authenticated session cookies in real time.
- ANY.RUN telemetry linked Mirage2FA to 3,518 unique organization email domains and 9,426 targeted email addresses, with 4,532 potentially compromised.
- 63.7% of identified victims were located in the United States, with activity also recorded across 94 countries.
- Technologies, Manufacturing, and Education were among the most targeted industries, with additional exposure in Consulting, Telecommunications, Health, and Finance.
- Session cookie theft was the most common compromise outcome, making stolen sessions more valuable than passwords alone.
- The toolkit relies on browser-based delivery using .htm, .xhtml, and .svg attachments, QR-code lures, obfuscated JavaScript, and WebSocket-based relay activity.
MITRE Techniques
- [T1566.001 ] Phishing: Spearphishing Attachment – Delivered malicious .htm, .xhtml, and .svg attachments to victims (‘A phishing email delivers a malicious .htm, .xhtml, or .svg attachment’).
- [T1566.002 ] Phishing: Spearphishing Link – Used QR-code links and phishing URLs to direct victims to the fake login flow (‘or directs the victim to a QR-code link’).
- [T1204.002 ] User Execution: Malicious File – The victim opening the attachment triggered browser-side execution (‘The victim opens the attachment, causing the browser to execute the embedded stager’).
- [T1027 ] Obfuscated Files or Information – Used obfuscated HTML and JavaScript to hide redirect and loader logic (‘Obfuscated HTML smuggling’ and ‘JavaScript obfuscation’).
- [T1027.006 ] Obfuscated Files or Information: HTML Smuggling – Browser-executed HTML/XHTML/SVG stagers fetched payload logic in the browser (‘The stager reads a per-recipient token’).
- [T1105 ] Ingress Tool Transfer – Retrieved harvesting logic from remote loaders (‘The stager retrieves the harvesting logic from a remote loader’).
- [T1557 ] Adversary-in-the-Middle – Intercepted Microsoft 365 authentication through a reverse proxy (‘backed by an Adversary-in-the-Middle reverse proxy’).
- [T1111 ] Multi-Factor Authentication Interception – Captured one-time 2FA codes during the login flow (‘The victim enters their username, password, and one-time 2FA code’).
- [T1539 ] Steal Web Session Cookie – Exfiltrated authenticated session cookies for reuse (‘The authenticated session cookies… are exfiltrated to the operator panel’).
- [T1071.001 ] Application Layer Protocol: Web Protocols – Used WebSocket traffic to relay authentication and support the attack flow (‘relays the authentication data… over a WebSocket channel’).
Indicators of Compromise
- [Domains ] C2/loader infrastructure and phishing domains – user.cheacker.store, hvr.volatilesour.store, ver.bandhiem.com, a1p2i.js loader host pattern, and other rotating kit domains
- [IP Addresses ] Loader, test, and operator infrastructure – 185.174.100.224, 185.174.100.20, and 199.233.237.30
- [File Names / Paths ] Browser-executed stagers and loader paths – a1p2i.js, /api/xls/a1p2i.js, and /xls/
.js - [File Extensions ] Delivery formats used by the kit – .htm, .xhtml, and .svg
- [URL / Request Patterns ] Network hunting patterns for Mirage2FA – /[a-z]{3}/xls/[a-z0-9]+(?:c2v|cpt)?.js and /???/xls/?????*.js$
- [Tokens / Placeholders ] Operator and build markers embedded in samples – LINXB64EMAIL, LINXEMAIL, LINXCODERSEMAIL, and linxz
- [Email / DNS Artifacts ] Base64-encoded email used in subdomains and tokenized delivery –
.cheacker.store and recipient-specific labels - [Hashes / Encoded Logic ] Obfuscated JavaScript behavior seen in samples – atob(…).map(x => x.charCodeAt(0) ^ 173) followed by eval(…)
Read more: https://any.run/cybersecurity-blog/mirage2fa-phishing-targets-us-companies/